• Sublime Core Feed

Sublime Core Feed

This repo contains open-source Rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing.

Sublime Security
Last updated Mar 27th, 2026
Feed Source
Tactic or Technique is
Rule Name & Severity
Author
Last Updated
Labels
Attachment: Fake lawyer & sports agent identities
Sublime Security
2mo ago
Jan 26th, 2026
Google share notification with suspicious comments
Sublime Security
2mo ago
Jan 12th, 2026
Impersonation: Executive using numbered local part
Sublime Security
1mo ago
Jan 30th, 2026
Service Abuse: Box file sharing with credential phishing intent
Sublime Security
2mo ago
Jan 12th, 2026
Service abuse: Trello board invitation with VIP impersonation
Sublime Security
1mo ago
Feb 3rd, 2026
Suspicious attachment with unscannable Cloudflare link
Sublime Security
2mo ago
Jan 12th, 2026
Suspicious request for financial information
Sublime Security
3mo ago
Dec 6th, 2025
VIP / Executive impersonation in subject (untrusted)
Sublime Security
7mo ago
Aug 14th, 2025
VIP / Executive impersonation (strict match, untrusted)
Sublime Security
1mo ago
Feb 25th, 2026
VIP impersonation: Fake thread with display name match, email mismatch
Sublime Security
2mo ago
Jan 12th, 2026
VIP impersonation with BEC language (near match, untrusted sender)
Sublime Security
5d ago
Mar 25th, 2026
VIP impersonation with charitable donation fraud
Sublime Security
4mo ago
Nov 12th, 2025
VIP impersonation with invoicing request
Sublime Security
2y ago
Apr 23rd, 2024
VIP impersonation with urgent request (strict match, untrusted sender)
Sublime Security
5d ago
Mar 25th, 2026
VIP impersonation with w2 request with reply-to mismatch
Sublime Security
18d ago
Mar 12th, 2026
VIP local_part impersonation from unsolicited sender
Sublime Security
7mo ago
Aug 12th, 2025